Slashdot Mirror
HP Will Give You $10,000 To Hack Your Printer (zdnet.com)
hyperclocker shares a report: HP hopes to entice researchers with a $10,000 reward for finding vulnerabilities in printers. The tech giant revealed the new bug bounty program on Tuesday. The scheme, which is launching as a private bug bounty, is tailored specifically for HP printer hardware. While many of us use home printers simply for printing the occasional document or photo, in the enterprise, these devices are often found in a network. If there is a weak link in business networks, a single device -- whether it be a printer or smart air conditioning system -- can be exploited to compromise a wider network system.
Printers, especially if they are overlooked when it comes to firmware updates or upgrades, can become such avenues to exploit. According to research undertaken by Bugcrowd, "2018 State of Bug Bounty Report," endpoint devices are becoming a tantalizing target for threat actors, with a 21 percent increase in total endpoint bugs reported over the past 12 months. In partnership with bug bounty platform Bugcrowd, HP says it is the "only vendor" to launch a printer-only vulnerability disclosure scheme. Under the terms of the program, researchers can earn between $500 and $10,000 per legitimate find.
Printers, especially if they are overlooked when it comes to firmware updates or upgrades, can become such avenues to exploit. According to research undertaken by Bugcrowd, "2018 State of Bug Bounty Report," endpoint devices are becoming a tantalizing target for threat actors, with a 21 percent increase in total endpoint bugs reported over the past 12 months. In partnership with bug bounty platform Bugcrowd, HP says it is the "only vendor" to launch a printer-only vulnerability disclosure scheme. Under the terms of the program, researchers can earn between $500 and $10,000 per legitimate find.
With a hammer.
I think it was a HP one too.
The millennial that doesn't like most of the stuff designed for millennials.
$10K to cut off 3rd party ink hacks is good spending.
This is probably to "secure" HP Instant Ink, which monitors your printer so you can give an unlimited amount of money to HP, for ink refills.
It's basically the renting models for printers, except you pay for the printer, pay for the ink, pay to be monitored, and pay either per page , or per month.
The best part is, when the printer dies, you also get to pay for the recycling!
HP can also help you, by automatically sending you relevant ads, on the printer you paid for, with the paper you paid for, with the ink you pay for, with the electricity you pay for, and you compensate HP for this by letting them have access to your printing data and network!
this s how fxping piracy was done in late 90's early 00's , seems its making a come back and they need help setting up honey pots again
go fuck yourselves ....not helping
Never mind.
I had some HP printers once, a long time ago. They were such POS that I swore I'd never buy another. And I never have.
Epson FTW.
Gee, I'd love to help you here, HP, but since none of your currently manufactured printers work with linux, I guess I'll have to pass.
Redeemable as 2.5 cups -- 3 gallons of printer ink.
Wow this is a lot.
Does removing the yellow dots that identify which printer a document came out of count?
So my computer or iphone can find it. My HP printer is a shit printer.
Besides hacking off the yellow ink bin. What is this the Soviet Union?
I miss my old LaserJets. They were like an ox: slow, hot, and reliable over long distances.
12:50 - press return.
Do they think a lottery inspires more confidence? $10000 is peanuts, and it's up to $10000, but maybe only $500.
Ecotank.
Hacked mine to say my name. Please send my 10k.
Sincerely,
-Paul Christopher Loadletter
Well hey, Canon has telemetry in their printers and Epson has built-in end-of-life in theirs. I'm not sure about HP, Samsung or Brother printers. I do know that my Okidata doesn't have any of that crap.
I don't think this is the case. It is more like $10K to show how woefully inadequate printer security is, so you have to buy a whole new printer that is up to last years standards, that are already obsolete.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
I remember fondly a long time ago, when one employee brought his private first HP color printer to his office and installed it on his machine.
The install process replaced the print queue and it began immediately checking the company network for all printers that might be out of paper or ink, all over the world, from the US, to Europe, India and Japan.
After an hour it had consumed all the bandwidth available polling 10-15000 printers and the network broke down.
It was fun working IT those days.
requires hacks
My printer is a lj2300 with a jetdirect card which has well-known vulnerabilities which hp has decided not to fix. This is just pretense at caring about security, they don't actually give one shit.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Maybe I "want" to hack my printer, without having HP screw it up.
There is not enough mass in my body to hold the hate HP devices have grown in me, is like a black hole of suck... It has made my work day a continuous bottleneck.
How can you even tell if your printer has been hacked or whether it's just HP's amazingly crappy drivers, software, and firmware?
We've got two at work that are constantly breaking on their own. They'll mysteriously go to sleep and never wake up (yes, we disabled going to sleep). They'll stop responding and need to be hard power cycled by yanking the cord. The software is an astoundingly giant pile of crap (about a gig worth) that doesn't seem to do anything useful except burn 20% cpu. I know how to drop the software and keep just the drivers, but most people here don't. And then if you've just got the drivers it occasionally nags you about 'finishing the installation' by installing the rest of their crapware. The ink tanks are smaller than the bladder of an 80 yo man with prostate issues.
I just use the Canon laser printer. That thing is rock solid and it runs fine with just the drivers. But being unofficially the guy who knows computers I keep getting drawn in with those f@#$ing HPs. If I had my way we'd run over them with a truck and replace them with Brother laser printers. That's the ultimate HP lifehack.
Never mind hunting out vulnerabilities, pay people to get the bloody hp printers to work reliably.
I stopped buying HP printers when they stopped supporting Linux properly. I stopped recommending them when the introduced region locked protection on consumables. Given their anti-user policies does anyone still use them as the benchmark for a good printer like they used to be a decade ago? For me HP printers are just a sad footnote in history of a company who once understood their customers, then lost the plot just to keep bean counters happy.
People who buy Inkjets are 100% vulnerable to being ripped off for being fucking idiots. Send my check to the "Help make murika smart again" charity.
or maybe just play with the IIS a little on HP's shitty web server.
"Sheeet, ain't much point in hacking your printer unless it lets you print out your own ten grand."
-above-average intelligence Texan/genius-level Okie
What's a Printer?
Is that like a CD or Palm Pilot? Just wondering.
Print cartridges (remanufactured) and photo paper for your printer. Enough for 500 pages.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
Just give me free ink for life.
Captcha: "illegal". It's like Slashdot has AI...
My HP Laserjet 5si with a JetDirect card has telnet and ftp wide open without authentication. Pay up HP.
The average HP printer goes dead after no longer than a year anyway. It's futile task to try to hack them, by the time you're done, it probably croaks anyway.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Does anyone remember HP pen plotters in the '80s with "Hewlett Packard Grit Wheel Paper-Moving Technology"(TM)?
"When the going gets weird, the weird turn pro" -- HST
Those are the only hacks that are worth it for consumers. Don't lift a finger to help HP do their own security and product R&D unless they pay you.
Still bitter after my Samsung color laser got stealth upgraded after HP bought the product line.. I had a full set of 3rd-party toner carts that were working *perfectly* until the software made the printer go full-on a$$hole and reject them. Now I have to pay over $400 for toner refills. I'd be better off printing my pages with gold dust at those rates.
for just getting the printer to work?
This is in regards to their Multifunction Enterprise copiers (Futuresmart 4). They run embedded linux, export a SOAP sdk for remote coding, embedded applications and authentication.
The last time I downloaded a Laserjet Windows Driver, I think it was about a 350MB payload.
That's a lot of printer driver. Surely there must be tons of exploits and badly written code in that big of a turd.
HP provide all the firmware ever made!
I picked up a second hand HP LaserJet 4700dn from 2007. The firmware is so old that I can't update it because the HP website has firmware that is too new that it the printer wont accept it.
Trying to browse the HT website and FTP, even the web archive and FTP search crawlers found nothing.
Other than that once I replaced the transfer kit and added an old 512MB RAM stick from a retied laptop it has been great.
Don't waste time and money with HP. Get an Epson EcoTank instead and, if you're planning to use it for a very long time, invest in a waste pad replacement or a bladder.
Nice - offers $10K reward, then probably only pays $500 when a serious vulnerability is found.
This is somewhat similar to the "please fill out this 10-page survey, and you have the chance to win $20K!", except that no one ever wins anything.
Privacy begins with
In my office building my phone shows an HP printer for a WIFI AP....
A friend of mine used the folowing tactic to persuade the owner to turn WIFI off: He printed a warning: your WIFI is on, anybody can use your toner and paper. First once a day, then more often...
I wouldn't say that, HP has put out driver updates that update the firmware on the LaserJet models to require signed firmware updates if they didn't require it already. My guess is people were bypassing the page count limit per toner cartridge restriction, but it could have also been the yellow dots identification mechanism being bypassed that they wanted to protect.
This just makes it easier for them to lock it down further, by patching exploits that could get around their restrictions.
I have a HP Officejet Pro 7612. I have little experience in hacking (I have almost finished stripe CTF 2), but I have not found much documentation abour my printer. I am interested in trying to hack my printer, at least to know better all it can do. Do you have links to doc or code?
Interestingly the last HP advert I saw about printers directly talked about security risks that are network attached printers. It seems HP may be the only company that is at least giving this space some thought.
Not that I think they have coders capable of making secure printers, but they are giving it some thought.
when the hardware is garbage?
They are just trying to get us to buy hp printers to hack.
Wow, I could almost afford to do a full first-party ink cartridge replacement with that kind of money! What a fucking scumbag company... the printer market needs to shoot itself in the foot already.
$10K to cut off 3rd party ink hacks is good spending.
I picked up an HP office jet 476dx and I bought 3rd party inks.... and the printer gave some generic error and refused to use the cartridges.
Then I updated the firmware to HP's latest, and I could use the inks.
The point is that they shipped a printer that couldn't use third party inks, and then were guilted or otherwise moved to update the firmware to allow them. The printer now works fine with 3rd party inks that cost 1/4 what HP charges, and I only have to tolerate the printer bitching a bit when I replace a cartridge ('You really should use HP inks, never know about this third party stuff.')
I'd say that's good enough.
Alcohol, Tobacco and Firearms should be the name of a store, not a government agency.
Back in the day, there was no printer security to speak of, and we had HP printers available all over the WAN. I got bored one day so I set their default messages to perplexing things such as "INSERT COIN", or "OUT OF CHOCOLATE". This was when most people were still afraid of the arrival of computers in the workplace - credulous, nearly to a man - so the effect was very satisfying.
And I also wrote a program to simulate a dirty mouse (back when they had balls). Gave it to one of the IT guys and we heard the lady in shipping and receiving beating the shit out of it on her desk, and he ran over to stop her but we were both laughing until we had tears.
Man, those were the days.